From 4e710d2a7a8367f8132b8254e89a00b46c333bda Mon Sep 17 00:00:00 2001
From: Vladimir <vladimirbrejcha@icloud.com>
Date: Thu, 20 Aug 2026 17:12:09 +0800
Subject: [PATCH 1/3] ci: require hosted repository verification

---
 .github/workflows/verify.yml | 28 ++++++++++++++++++++++++++++
 README.md                    |  5 ++++-
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/verify.yml

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
new file mode 100644
index 0000000..8bf9b0c
--- /dev/null
+++ b/.github/workflows/verify.yml
@@ -0,0 +1,28 @@
+name: Verify
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: verify-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Verify repository contract
+        run: ./scripts/verify.sh
diff --git a/README.md b/README.md
index 3fb5a93..862b69d 100644
--- a/README.md
+++ b/README.md
@@ -78,7 +78,10 @@ npx --yes skills@1.5.14 add 'pbakaus/impeccable#skill-v3.9.1' \
 `WORKFLOW.md` keeps this repository usable by Autopilot and Symphony after the
 old catalog harness is removed. Its validation command is the small,
 non-mutating `scripts/verify.sh`; neither file is a registry or compatibility
-layer.
+layer. Pull requests, merge-queue entries, and updates to `main` run the same
+command on a standard GitHub-hosted Ubuntu runner. The `verify` job is the
+required status check for `main`; it uses read-only repository permissions and
+does not use repository secrets.
 
 The archived catalog system is preserved at Git tag
 `archive/catalog-system-final`.

From f9174f58e0cb15bcd8e0baaa7e41cb6af9484d3f Mon Sep 17 00:00:00 2001
From: Vladimir <vladimirbrejcha@icloud.com>
Date: Thu, 20 Aug 2026 17:14:32 +0800
Subject: [PATCH 2/3] ci: install hosted verification dependencies

---
 .github/workflows/verify.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 8bf9b0c..2d5b4e9 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -20,9 +20,14 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
+      - name: Install media test dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes ffmpeg
+
       - name: Verify repository contract
         run: ./scripts/verify.sh

From 72f1115c07b14ae2cfc68bcb5107bbc6cfa8b162 Mon Sep 17 00:00:00 2001
From: Vladimir <vladimirbrejcha@icloud.com>
Date: Thu, 20 Aug 2026 17:15:45 +0800
Subject: [PATCH 3/3] ci: install repository scan dependency

---
 .github/workflows/verify.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 2d5b4e9..47fa506 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -24,10 +24,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install media test dependencies
+      - name: Install verification dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install --no-install-recommends --yes ffmpeg
+          sudo apt-get install --no-install-recommends --yes ffmpeg ripgrep
 
       - name: Verify repository contract
         run: ./scripts/verify.sh